CVE-2026-47358
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Terrascan v1.18.3 and prior are vulnerable to SSRF via external URL resolution in uploaded IaC templates when running in server mode. An unauthenticated attacker can upload a template with a field pointing to a controlled URL, causing server-side fetch. Local file read via file:// scheme is also possible.
Risk Assessment
An attacker can read sensitive files from the server, leading to data leakage. The lack of available patches increases the risk.
Recommendation
Discontinue using Terrascan in server mode or replace it with another tool, as the project is archived and will not receive patches.
Other vulnerabilities in Terrascan
See all- CVE-2026-47357High
Terrascan v1.18.3 and prior are vulnerable to SSRF via the remote_url parameter in the remote directory scan endpoint in server mode. An unauthenticated attacker can supply an HTTP URL passed to go-getter without validation. Go-getter supports X-Terraform-Get header for redirect to file:// URL, enabling local file read. Additionally, ~/.netrc is read, potentially leaking credentials.
- CVE-2026-47356High
Terrascan v1.18.3 and prior are vulnerable to SSRF via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) in server mode. An unauthenticated attacker can supply an arbitrary URL, and Terrascan sends scan results with the webhook token to that URL.
Original NVD description (English source)
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external URLs referenced within those templates via hashicorp/go-getter with all default detectors enabled, including FileDetector. An unauthenticated remote attacker can upload an ARM template containing a templateLink.uri or parametersLink.uri field, or a CloudFormation template containing an AWS::CloudFormation::Stack TemplateURL field, pointing to an attacker-controlled URL. Terrascan will fetch the attacker-controlled URL server-side. Unlike SSRF via the remote scan endpoint, file:// URLs are directly usable without requiring an X-Terraform-Get redirect, enabling local file read. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released.